> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/tjctf-2023/web-outdated.md). # web/outdated ### Challenge Description

### Challenge Attachment {% file src="/files/tTuci5N3UBczNkYXU8st" %}

so this website takes a python code file from the user and executes it in the server using the command subprocess

so to execute a python file we have to click on the upload button

before submitting any file intercept the submit request using burp and then send the request to repeater

i have created a simple python file that prints a string

in the response it shows us the code and the resonse of the code executed

so what we have to do now is try to locate the flag in the server and print it after trying to list the files in the current directory it somehow blocks us

looking at the source code we find out that it's blocking a bunch of very important keywords that normally used to execute system commands

so we have to escape them and try to find another way 1. List all classes which are running in this python system by using this command `print("".__class__.__mro__[1].__subclasses__())`

the response is not clear so right click on the response and then click on show response in browser and copy the link and paste it in the browser

so let's copy all the array and paste it in an editor so we can view them properly 2. Find the index of `` in this case the index of `` is 132

3. Call the system module in `__globals__` to list files and directories by using this command `"".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['s' + 'ys' + 'tem']('ls -la')`

and we can see the flag so now let's use the command cat to read its content 4. Show the flag string from `flag.txt` by using this command `"".class.mro[1].subclasses()[132].init.globals['s' + 'ys' + 'tem']('cat flag-8f42541e-b457-42a3-8aae-a43d2d9782da.txt')`

### Flag ``` tjctf{oops_bad_filter_3b582f74} ```